Controller & Contact: This Privacy Policy is issued by MarketingHero Limited (dba SEOPulse) (“SEOPulse”, “Provider”, “we” or “us”), Unit 2904-05, 29/F, Universal Trade Centre, No.3 Arbuthnot Road, Central, Hong Kong. For any privacy-related inquiries, you can reach us at [email protected]. We value your privacy and strive to collect and use personal data strictly to the extent necessary to deliver and improve our Software-as-a-Service (SaaS) platform in a transparent, secure, and privacy-friendly manner, complying with applicable data protection legislation, including the Hong Kong Personal Data (Privacy) Ordinance (PDPO), the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable global privacy laws.
Scope & Overview: This Privacy Policy explains how we process personal information across different operational scenarios: when you visit our website (www.seopulse.io), sign up or onboard as a customer or partner, use our platform as an authenticated user, receive communications or schedule meetings, make payments, or when your data is processed within our internal operational workflows. We describe what personal data is processed, the specific operational purpose, the applicable legal basis (under PDPO, Article 6 GDPR, or equivalent privacy frameworks), our third-party service providers (“processors”), international transfers, and your statutory data subject rights.
1. When You Visit Our Website
In brief: We use our website to inform you about SEOPulse and provide information regarding our AI search and LLM visibility analytics platform. We deploy certain website analytics and marketing tools to understand site traffic and deliver a functional, secure experience while minimizing personal data collection. Our website is hosted on Hostinger (Hostinger International Ltd. / Hostinger UK Limited). Non-essential analytics or tracking cookies are deployed strictly with your consent.
Purpose: To deliver and load the website securely, ensure network integrity, and prevent cyber threats. With your express permission via our cookie consent banner, we collect aggregated analytics (e.g., page views, session duration, referring URLs) to optimize website usability.
Data & Cookies Collected: When visiting our site, technical connection data is automatically processed, including your IP address, device type, operating system, browser type/version, and referral URLs. Essential functional cookies are used solely to deliver basic website capabilities (e.g., load balancing, security) and do not require prior consent. Non-essential cookies for analytics or marketing are deployed only if you opt in via our consent banner. Declining optional cookies will not impact basic site usability.
Legal Basis: Delivery of technical website connection data is based on our legitimate business interest (Art. 6(1)(f) GDPR / PDPO Data Protection Principles) in operating a secure and functional web presence. Deployed analytics or marketing cookies rely exclusively on your voluntary consent (Art. 6(1)(a) GDPR).
Service Providers / Processors: We utilize Hostinger (UAB “Hostinger”) and WordPress (Automattic Inc.) for secure website hosting and content delivery. For site analytics, we utilize Google Analytics 4 (Google Ireland Ltd.), configured with pseudonymization and IP truncation within the EU to ensure personal identification is avoided. We use Google Tag Manager (GTM; Google Ireland Ltd.) to manage website tracking scripts without storing personal data directly. With your consent, we utilize Microsoft Clarity to analyze user interactions, and Google Ads (Google Ireland Ltd. / Google LLC) for marketing conversion tracking. All providers operate under strict Data Processing Agreements (DPAs) solely on our instructions.
2. When You Sign Up or Onboard as a User or Agency Partner
In brief: When you register for a SEOPulse account, sign up for a product demo, or apply for our Approved Agency Partner Program, we collect information necessary to establish, verify, and administer your account workspace. We store account details securely in Google Cloud infrastructure.
Purpose: To create your user account, verify access authorization, set up organization workspaces, deliver authentication links, administer Agency Partner configurations, and provide onboarding support.
Data Collected: Work email address, user full name, organization/company name, selected password/credentials, internal account ID, and technical access metadata (such as IP address at registration/login and timestamp).
Legal Basis: Processing is necessary for the performance of a contract (Art. 6(1)(b) GDPR / PDPO DPP 1) to establish your account workspace and grant authorized platform access.
Processors: We utilize Firebase Authentication and Google Cloud Firestore (Google Ireland Ltd.) and Cloudflare, Inc. for secure identity management, account credential processing, and content delivery. For commercial agreement signatures, we utilize SleekSign.
Storage & Retention: Account registration data is retained for as long as your account remains active. Upon account termination or written deletion request, registration data is purged within 30 days, except where statutory record retention obligations apply (e.g., commercial correspondence).
3. When You Use Our Product (Authenticated Users)
In brief: When you log into and use the SEOPulse application, we process data strictly to execute your query configurations, track brand visibility across target LLM search engines, generate analytical reports, monitor platform performance, and deliver technical customer support. With your consent, SEOPulse deploys Microsoft Clarity inside the application interface for session recording and UX analytics, including heatmaps and interaction tracking, to improve platform usability.
Purpose: (A) Delivering core AI visibility and citation analysis across selected LLMs; (B) Processing query inputs and prompts; (C) System monitoring, error debugging, and security logging; and (D) In-app support chat and customer assistance.
Data Collected: Prompts, brand keywords, target URLs, and search inputs entered into the platform (‘Input’); search results, sentiment scores, and citation metrics returned (‘Output’); IP addresses, session timestamps, and technical performance logs; in-app support chat messages.
Legal Basis: Performance of our subscription contract with your organization (Art. 6(1)(b) GDPR / PDPO DPP 1). System security and error debugging rely on our legitimate business interests (Art. 6(1)(f) GDPR) in maintaining a safe and reliable service.
Processors: Google Cloud Platform (GCP – Frankfurt/USA) for application hosting and database operations; Supabase (Supabase Inc.) for database and backend services; Hostinger (UAB “Hostinger”) for web hosting; Vercel (Vercel Inc.) for frontend deployment and edge delivery; Cloudflare, Inc. for content delivery and security; New Relic, Inc. for application performance monitoring and telemetry.
Storage & Retention: Prompt configurations and generated analytics workspace data remain stored during your active subscription. You can archive or export search configurations directly via the application interface. Upon account termination or deletion request, workspace data and associated analytics content will be purged from live production systems within 30 days. Residual copies in encrypted backups are securely overwritten in the ordinary course of the backup cycle, and no later than ninety (90) days thereafter, during which time backup data remains isolated and access-restricted.
4. When You Receive Communications, Contact Us, or Schedule Meetings
In brief: If you subscribe to updates, request a product demo, write to our support team, or book a consultation call, we process your contact information to communicate with you effectively.
Purpose: Delivering requested information, conducting product demonstrations, sending essential account/transactional alerts, handling customer inquiries, and managing commercial relationships.
Data Collected: Name, business email address, phone number, company name, position, meeting notes/summaries, support ticket content, and email interaction metadata (open rates, link clicks). Email engagement data is collected via tracking pixels or unique links embedded in emails we send. If you wish to prevent pixel tracking, you can disable automatic image loading in your email client settings; this will not affect your ability to receive or read our emails.
Legal Basis: Consent (Art. 6(1)(a) GDPR) for promotional newsletters or demo requests; Contractual necessity (Art. 6(1)(b) GDPR) for service notifications, invoices, and support inquiries; Legitimate interest (Art. 6(1)(f) GDPR) for customer relationship management and business contact enrichment.
Processors: Mailerlite.com (transactional and marketing email delivery); Google Workspace (Google Ireland Ltd.) for email hosting and document management; and Krisp Technologies Inc. for AI-powered noise cancellation and call recording. All platforms operate under signed Data Processing Agreements (DPAs) and are permitted to process your data only on our instructions for the purposes described above.
Storage & Retention: Marketing contact details are kept until you unsubscribe via the link in any email. Transactional and support communications are retained in account history and purged upon account termination or statutory retention expiration.
5. When You Make a Payment (Paying Customers)
In brief: For paid subscription plans or invoices, we process billing and transaction data. Payment card details are processed directly by our PCI-DSS certified payment processor, Stripe.
Purpose: Processing payments, issuing tax-compliant invoices, managing recurring subscription billing, and fulfilling statutory accounting/tax compliance.
Data Collected: Billing contact name, business address, company registration/VAT ID, payment transaction reference tokens, card brand, expiration date, and truncated card digits (last 4). Full payment card numbers are processed directly by Stripe and are never received or stored on SEOPulse servers.
Legal Basis: Contractual necessity (Art. 6(1)(b) GDPR) to process payments for purchased services; Legal obligation (Art. 6(1)(c) GDPR / Hong Kong Inland Revenue Ordinance) to retain financial records.
Processors: Stripe Payments Europe Ltd. / Stripe, Inc. operates as our secure payment processing partner.
Storage & Retention: Billing records, tax invoices, and payment receipts are retained for up to seven (7) years in accordance with statutory Hong Kong tax and financial audit requirements.
6. Internal Operations & Administration
In brief: We process personal data internally for corporate administration, legal contract archiving, operational oversight, and managing candidate applications.
Purpose & Data: Internal administrative processing includes team communications regarding customer service delivery, legal contract maintenance, business record-keeping, corporate governance, and processing job applications (CVs, cover letters, certificates, interview notes, and candidate evaluations).
Legal Basis: Necessary for contract performance (Art. 6(1)(b) GDPR), legal compliance (Art. 6(1)(c) GDPR), or legitimate interests (Art. 6(1)(f) GDPR) in operating an efficient corporate business.
Processors: Google Workspace (Google Ireland Ltd.) and Google Drive (Google Ireland Ltd.).We have signed Data Processing Agreements with each of these providers, confirming they act solely on our instructions and may not use your data for their own purposes.
Storage & Retention: Unsuccessful job applicant records are purged within six (6) months following the conclusion of the recruitment decision. Corporate contracts and corporate archives are retained for active term plus statutory limitation periods.
7. International Data Transfers
As a Hong Kong business operating globally, using cloud platforms (GCP, Supabase, Hostinger, Vercel, Cloudflare, New Relic, Firebase, Google Cloud Firestore, Mailerlite.com, Google Workspace, Google Drive, Krisp, Stripe, SleekSign, Microsoft Clarity, Google Analytics 4, Google Tag Manager, and Google Ads) may involve transferring personal data to data centers located in the European Union, United States, United Kingdom, Hong Kong, or other third countries. Where international transfers occur, we implement valid statutory safeguards in compliance with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Hong Kong Personal Data (Privacy) Ordinance (PDPO). For transfers to the United States, many of our processors (including Google, Cloudflare, Vercel, New Relic, Stripe, and Microsoft) are certified under the EU-US Data Privacy Framework (DPF) and/or the UK Extension thereto, which the European Commission has recognized as providing an adequate level of protection. Where DPF certification does not apply, we rely on European Commission Standard Contractual Clauses (SCCs — Module 2: Controller-to-Processor, Module 3: Processor-to-Processor, or Module 4: Processor-to-Controller as applicable), the UK International Data Transfer Addendum, or other approved adequacy frameworks. We conduct Transfer Impact Assessments where required to confirm that these safeguards are effective in practice. Your personal data receives an equivalent level of protection regardless of the country to which it is transferred.
8. Your Data Protection Rights
Depending on your jurisdiction, you hold specific statutory data subject rights regarding your personal information:
Access: Right to request confirmation and copies of your personal data processed by us.
Correction / Rectification: Right to request correction of inaccurate or incomplete personal records.
Erasure / Deletion: Right to request deletion of your personal data when no longer necessary for contractual or legal grounds.
Restriction & Objection: Right to restrict or object to data processing based on legitimate interests or direct marketing.
Data Portability: Right to receive your structured data in a machine-readable format for transfer.
Withdraw Consent: Right to withdraw consent at any time without affecting prior lawful processing.
To exercise any data rights, please submit a written request to [email protected]. We will respond to verified requests free of charge within one month of receipt, as required by law. Where a request is complex or we receive a high volume of requests, we may extend this period by a further two months; we will notify you of any such extension within the first month (Art. 12(3) GDPR). You also have the right to lodge a complaint with your local data protection supervisory authority at any time. For EU users, this is the supervisory authority in your country of residence or place of work. For UK users, this is the Information Commissioner’s Office (ICO, ico.org.uk). For Hong Kong users, this is the Office of the Privacy Commissioner for Personal Data (PCPD, pcpd.org.hk).
9. Data Security & General Information
We deploy administrative, physical, and technical security safeguards designed to protect personal data against unauthorized access, destruction, or disclosure. Measures include HTTPS/TLS encryption in transit, cloud encryption at rest, mandatory access control, and least-privilege authorization. We periodically review our security practices to align with industry standards. In the event of a personal data breach affecting personal data, we will notify the relevant supervisory authority and affected individuals in accordance with applicable data protection laws (including Art. 33 and Art. 34 GDPR where applicable), without undue delay. We do not engage in automated decision-making or profiling having legal effects. Our services are strictly intended for commercial entities and individuals aged 16 or older.
We may update this Privacy Policy from time to time to reflect operational or regulatory updates. Material changes will be communicated via email or platform notification. Contact us anytime at [email protected].